CVE-2026-66028: Ekushey Project Manager Auth Bypass Flaw

CVE-2026-66028 Overview

CVE-2026-66028 affects Ekushey Project Manager CRM through version 5.0. The application fails to enforce a uniqueness constraint on the client email field, allowing authenticated administrators to create multiple client accounts sharing the same email address. Each duplicate account can hold a different password, producing conflicting authentication states. When a client attempts to log in, the resulting behavior is non-deterministic and can grant access to an account other than the one intended. The flaw is classified under [CWE-303] (incorrect implementation of authentication algorithm).

Critical Impact
Attackers with administrative access can weaponize duplicate email registrations to hijack client sessions and gain unauthorized access to client data through unpredictable authentication resolution.

Affected Products

Ekushey Project Manager CRM (all releases through version 5.0)
Deployments distributed via CodeCanyon marketplace
Instances that expose client authentication endpoints to the network

Discovery Timeline

2026-07-27 - CVE-2026-66028 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66028

Vulnerability Analysis

The vulnerability resides in the client account creation workflow of Ekushey Project Manager CRM. The application accepts new client registrations without validating that the submitted email address is unique across existing records. Administrators can therefore create multiple client rows tied to the same email but with distinct password hashes.

When a client authenticates, the login handler queries the datastore by email. Because multiple rows match, the query returns an ambiguous result set. The application selects one record based on insertion order or database engine internals rather than an explicit business rule. This produces inconsistent authentication outcomes across sessions.

The issue maps to [CWE-303], reflecting an incorrect implementation of authentication logic that depends on data integrity constraints the schema does not enforce.

Root Cause

The schema lacks a UNIQUE constraint on the client email column. Application-layer validation to reject duplicates is also absent. Password verification against an ambiguously resolved record breaks the one-to-one relationship expected between an identity and its credentials.

Attack Vector

Exploitation requires network access to the CRM and high privileges, specifically an authenticated administrator account. An attacker with administrator credentials creates a duplicate client account using a target client's email and an attacker-controlled password. Subsequent logins may authenticate against the attacker-planted record, granting session access to the legitimate client's data. Details are documented in the VulnCheck Advisory for Ekushey CRM and the GitHub CVE-2026-66028 Disclosures.

Detection Methods for CVE-2026-66028

Indicators of Compromise

Multiple client records in the CRM database sharing an identical email address but differing password hashes.
Client login events resolving to different internal user IDs across sessions from the same email.
Administrator-initiated client creation events immediately preceding anomalous client logins.
Access to client data by sessions bound to newly created accounts with no legitimate activity history.

Detection Strategies

Run periodic SQL audits against the client table using GROUP BY email HAVING COUNT(*) > 1 to surface duplicate registrations.
Correlate administrator account-creation actions with subsequent client authentication events targeting the same email.
Monitor authentication logs for the same email resolving to different account identifiers.

Monitoring Recommendations

Enable verbose audit logging on administrator actions within the CRM, including account creation and modification.
Forward CRM application and database logs to a centralized logging platform for retention and correlation.
Alert on any creation of a client record whose email already exists in the datastore.

How to Mitigate CVE-2026-66028

Immediate Actions Required

Audit the client table for duplicate email addresses and reconcile or remove unauthorized records.
Restrict administrator access to the CRM to a minimal set of trusted personnel and enforce multi-factor authentication on those accounts.
Force password resets for any client accounts identified as affected by duplicate registrations.

Patch Information

No vendor patch is referenced in the published advisories at the time of writing. Consult the CodeCanyon item details for vendor updates and apply any subsequent releases addressing this issue.

Workarounds

Add a UNIQUE constraint on the client email column at the database schema level to reject duplicates.
Introduce server-side validation in the client creation handler to reject any email already present in the datastore.
Restrict administrative account-creation functionality to a break-glass process until a fix is deployed.
Review and normalize existing client records so that each email corresponds to exactly one account.

bash

# Configuration example
# Enforce email uniqueness at the database layer (MySQL/MariaDB)
ALTER TABLE clients ADD CONSTRAINT uniq_client_email UNIQUE (email);